Privacy and terms

This page says what perfr.dev does with an account and a shared capture. It is a plain description, not a lawyer's document, and it is not a warranty or a promise about how long data is kept.

Account

An account is created when you sign in with GitHub, Google, or an email address you can read. For GitHub and Google we store that provider's account id, and the email, name, and picture they send. For email we store the address. We store a session cookie on this browser so the site can tell it is you. The cookie is not readable by scripts on the page. Signing out, or deleting the account, drops the session. You can also revoke one device from the account page.

Captures

A shared capture is stored so anyone with the link can open it. With the file we store its size, a hash, the time, a salted hash of the uploader's IP address (not the address itself), and the account that uploaded it. Captures shared before accounts existed have no account on them. The link still opens them.

Deleting a capture, or deleting your account, hides those captures. The database row stays, with a deleted time. The file may remain in storage until it is removed later.

The checkbox

On the account page this checkbox is off unless you turn it on. These words are the whole of the permission:

Allow Perfr to use my shared captures and stories to improve performance tooling, including training models

We store whether you opted in, and when, on your account and on each capture. A capture keeps the choice it had when it was uploaded, until you change that capture. Leaving the box off means we do not have that permission.

API tokens

You can create a token for the perfr command line. We store a hash of the token and a short prefix so you can recognise it. The token itself is shown once, on the account page. Revoking it stops it working.